Privacy Policy

1. Who we are

Wasleh ("we", "us") operates a community platform that connects diaspora travelers so they can carry small personal items for each other as a favor, free of charge. Wasleh currently connects members traveling along corridors between Lebanon, the United Arab Emirates, France, Spain, the United Kingdom, Germany, the Netherlands, Portugal, Canada, the United States, and Australia. For the purpose of the EU General Data Protection Regulation (GDPR), Wasleh acts as the data controller of the personal data you provide through the app.

2. Personal data we collect

• Account data: name, email address, password (hashed).
• Profile data you choose to add: avatar, hometown, current city, short bio, phone number.
• Trip and request data: origin/destination cities, dates, item descriptions, notes.
• Messages you exchange with other members through Wasleh chat.
• Reviews and ratings you post about other members or about the app itself.
• Technical data automatically collected when you use the app: device type, browser, IP address, and basic usage logs used for security and abuse prevention.

3. Why we process your data (legal bases under GDPR)

• Performance of a contract (Art. 6(1)(b)) — to create your account, match you with travelers, and enable the favor exchange.
• Legitimate interests (Art. 6(1)(f)) — to keep the community safe, detect abuse, moderate reviews, and improve the service.
• Consent (Art. 6(1)(a)) — where required, for optional features such as marketing communications. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to comply with applicable law.

4. Sharing with other members

Wasleh is a community app. When you post a trip or request, your name, avatar, city, and post details (including item descriptions and trip notes) may be visible to other signed-in members in the feed and connection screens so a match can happen. Phone numbers are shown only after two members mutually connect. We never sell your personal data.

Public share links (optional). You can choose to create a public link for one of your trips or requests. Public links are off by default and only exist if you turn them on. Anyone who has the link, including people without a Wasleh account, can see your first name, the route, dates, general space or item size, and your completed-exchange count. Item descriptions, trip notes, your surname, photo, and contact details are never shown on public pages. Public pages ask search engines not to index them, but we cannot control how people forward a link once you share it. You can turn a link off at any time and it stops working immediately. The legal basis is your consent (GDPR Art. 6(1)(a)), which you can withdraw by switching the link off.

5. Service providers

We rely on trusted infrastructure providers to host the app and store data (authentication, database, and hosting). These providers process personal data only on our instructions and under written data-processing agreements consistent with GDPR Art. 28.

6. International transfers

Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6-bis. German users (GDPR and the BDSG)

For users located in Germany, the EU General Data Protection Regulation applies together with the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). In addition to the rights described in section 8, German users may lodge a complaint with the competent state or federal data protection supervisory authority, and may contact us at hello@wasleh.app for any request concerning access, rectification, erasure, restriction, portability, or objection. Where we rely on consent (for example for optional marketing emails), that consent can be withdrawn at any time with effect for the future.

6A. Canadian users (PIPEDA and Quebec Law 25)

For users located in Canada, Wasleh takes steps to handle personal information in a manner consistent with the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), including limiting collection to what is needed for the purposes described in this policy, obtaining consent where appropriate, safeguarding the information, and being open about our personal information practices.

For users located in Quebec specifically, we also take Law 25 into account, including its requirements regarding consent, privacy by design, and the right to access and rectify personal information. This section is provided for transparency; it does not create obligations beyond those already described in this Privacy Policy or required by applicable law.

6B. US users (state privacy laws, including CCPA/CPRA)

For users located in the United States, Wasleh takes steps to comply with applicable US state privacy laws where they apply. Unlike some jurisdictions, US privacy law varies by state rather than existing as a single federal standard, and Wasleh's practices are designed to meet the requirements of the states it serves, including but not limited to California's California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). This section is provided for transparency; it does not create obligations beyond those already described in this Privacy Policy or required by applicable law.

6C. Australian users (Privacy Act 1988 and the APPs)

For users located in Australia, Wasleh handles personal information in a manner consistent with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This includes collecting only the personal information reasonably necessary for the purposes described in this policy (APP 3), being open and transparent about how we manage it (APP 1), using and disclosing it only for those purposes or as permitted by law (APP 6), taking reasonable steps to keep it accurate and secure (APPs 10 and 11), and giving you the ability to access and correct your information (APPs 12 and 13).

Where personal information of Australian users is disclosed to overseas recipients such as our hosting and infrastructure providers, we take reasonable steps to ensure those recipients handle it consistently with the APPs (APP 8). Australian users may contact us at hello@wasleh.app to make a privacy complaint, and may escalate unresolved complaints to the Office of the Australian Information Commissioner (OAIC).

7. Data retention

We keep account data for as long as your account is active. Trips, requests, and messages are kept while relevant to ongoing exchanges and community trust. You can delete your account at any time from your profile; we then delete or anonymise personal data within a reasonable period, except where retention is required by law.

8. Your GDPR rights

You have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You may also lodge a complaint with a supervisory authority in the EU country where you live or work. To exercise any of these rights, contact us at hello@wasleh.app.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords, row-level security in our database, and access controls. No system is perfectly secure — please protect your password and report any suspected misuse to us immediately.

10. Children

Wasleh is not intended for people under 16. If we learn that we collected data from a child, we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be highlighted in the app before they take effect.

12. Contact

Questions or requests: hello@wasleh.app.